REMARKS/ARGUMENTS 

This paper is being provided in response to the Office Action dated January 4, 2007 for 
the above-referenced application. In this response, Applicant has amended Claims 1, 22, and 41. 
Applicant respectfully submits that the amendments to the claims and the newly added claims are 
supported by the originally filed application. 

The rejection of Claims 1-7, 22-28, 41-52 and 63-65 under 35 U.S.C. 1 12, first 
paragraph, is hereby traversed and reconsideration thereof is respectfully requested. Claims 1, 
22, and 41 have been amended in accordance with remarks set forth in the Office Action to 
remove the previously recited feature without using directory information indicating which 
portions of the storage device are associated with a file. However, Applicant respectfully points 
out that scanning without using directory information is described in Applicant's specification, 
for example, at page 18, lines 10-14. 

In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

The rejection of Claims 1-4, 22-25 and 41-44, 46-52, and 63-65 under 35 U.S.C. § 
102(e) as being unpatentable over Waldin et al (U.S. Patent No. 6,094,731 hereinafter referred to 
as "Waldin") is hereby traversed and reconsideration thereof is respectfully requested. 

Claim 1, as amended herein, recites a computer implemented method of scanning a 
storage device for viruses, comprising: determining physical portions of the storage device that 
have been modified since a previous virus scan using information about the physical portions 
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without using information about a file structure, a file system, or a file type; detecting, by the 
storage device, write operations to tracks of the storage device; providing, to an antivirus unit by 
the storage device, information indicating which tracks of the storage device have been accessed 
for a write operation; and scanning, by the antivirus unit, at least parts of the physical portions 
for viruses, wherein scanning is performed without using information about a file structure, a file 
system, or a file type, and wherein scanning is performed on those tracks to which write 
operations have been directed in accordance with the information provided by the storage device. 
Claims 2-4, and 63 depend from Claim 1 . 

Claim 22, as amended herein, a computer program product for scanning a storage device 
for viruses, the computer program product including a computer-readable medium with 
executable code stored thereon for: determining physical portions of the storage device that have 
been modified since a previous virus scan using information about the physical portions without 
using information about a file structure, a file system, or a file type; detecting, by the storage 
device, write operations to tracks of the storage device; providing, to an antivirus unit by the 
storage device, information indicating which tracks of the storage device have been accessed for 
a write operation; and scanning, by the antivirus unit, at least parts of the physical portions for 
viruses, wherein the scanning is performed without using information about a file structure, a file 
system, or a file type, and wherein scanning is performed on those tracks to which write 
operations have been directed in accordance with the information provided by the storage device. 
Claims 23-25, and 64 depend from Claim 22. 

Claims 41, as amended herein, recites an antivirus unit, comprising: means for coupling 
to at least one storage device; means for determining physical portions of the storage device that 
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have been modified since a previous virus scan using information about the physical portions 
without using information about a file structure, a file system, or a file type; means for 
receiving, from the at least one storage device, information determined by the at least one storage 
device indicating which tracks of the at least one storage device have been accessed for a write 
operation; and means for scanning at least parts of the physical portions for viruses, wherein 
scanning is performed without using information about a file structure, a file system, or a file 
type, and wherein scanning is performed on those tracks to which write operations have been 
directed in accordance with the information provided by the storage device. Claims 42-44, 46- 
52, and 65 depend from Claim 41. 

Waldin discloses a system, method and computer readable medium for examining a file 
associated with an originating computer to determine whether a virus is present within the file. 
(See Abstract). Waldin discloses scanning a file and placing file the identification number of 
each sector that is scanned into a critical sectors. As each sector is operated upon, a hash value is 
calculated for that sector and inserted into the critical sectors file along with the size of the file 
scanned. (Col. 4, Lines 52-64; Figures 1 and 2). Waldin' s Figure 1 includes antivirus modules 
on an originating computer 2 and a recipient computer 1 1 and processing performed on each of 
the computer systems when transmitting a file from an originating computer to a recipient 
computer. (See Figure 1; Col. 3, Lines 22-34). Waldin' s Figure 3 determines if computed hash 
values for file 1 match stored hash values for file 1 . If not, the entire file 1 is rescanned. (Steps 
36, 37 of Figure 3; Col. 6, Lines 43-46; See also Col. 2, Lines 24-26). Waldin discloses 
determining hash values for only those sectors of a file actually retrieved by module 5 of Figure 
1. Module 3 of Waldin' s Figure 1 always scans the same set of sectors of a file unless the file 
changes in length or the contents of those sectors changes in some way. The antivirus accelerator 
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module 5 automatically hashes all sectors scanned by module 3 in the same way regardless of 
contents of the sectors. No new parser of hasher coding needs to be performed and incorporated 
into module 5 to support new file formats. (Col. 7, Line 35-Col. 8, Line 2). 

Claim 1, as amended herein, is neither disclosed nor suggested by Waldin in that Waldin 
neither discloses nor suggests at least the features of a computer implemented method of 
scanning a storage device for viruses, comprising: ... detecting, by the storage device, write 
operations to tracks of the storage device; providing, to an antivirus unit by the storage device, 
information indicating which tracks of the storage device have been accessed for a write 
operation; and scanning, by the antivirus unit, at least parts of the physical portions for 
viruses, ... wherein scanning is performed on those tracks to which write operations have 
been directed in accordance with the information provided by the storage device, as set forth in 
amended Claim 1 . 

As described above, Waldin' s Figure 1 includes antivirus modules executing on an 
originating computer 2 and a recipient computer 1 1 and processing performed on each of the 
computer systems when transmitting a file from an originating computer to a recipient computer. 
(See Figure 1; Col. 3, Lines 22-34). Waldin discloses an example in Column 7, beginning at line 
48 3 in which antivirus module 3 virus scans sectors 1, 3, and 10 from a file 1 of size 10K. If a 
change were made to either sectors 1, 3, or 10, module 3 would notice the change since it reads 
and scans these three sectors. Thus, Waldin discloses that changes to a sector within a file are 
detected by module 3, one of the antivirus modules on the originating computer 2. Waldin does 
not disclose or fairly suggest a storage device detecting write operations to tracks of the storage 
device, having the storage device provide information to an antivirus unit indicating which tracks 
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of the storage device have been accessed for a write operation, and then having the antivirus unit 
perform scanning on those tracks to which write operations have been detected in accordance 
with the information provided by the storage device. In distinct contrast, Waldin discloses the 
originating computer including the antivirus modules detecting changes to sectors which it reads 
and scans. The sectors which are scanned by module 3 are indicated in the critical sectors file 4. 
(See Col. 7, Lines 34-47) Thus, Waldin discloses the originating computer including the 
antivirus modules detecting changes to sectors, rather than the storage device detecting write 
operations to tracks . Furthermore, Waldin only detects changes for those sectors included in the 
critical sectors file. If a change is made to a sector which is not in the critical sectors file, the 
sector will not be rescanned unless the file length changes. (Col. 7, Lines 53-58). If a change is 
made to one of the sectors indicated in the critical sectors file, all sectors of the critical sectors 
file are rescanned in Waldin. Thus, Waldin does not disclose or fairly suggest scanning those 
tracks to which write operations have been directed . Rather, Waldin discloses scanning all 
sectors indicated in the critical sectors file if any one sector in the critical sectors file has been 
changed. Waldin further discloses that if a change is made to a sector not in the critical sectors 
file, the sector will not be rescanned unless the length of the file changes. 

In view of the foregoing, Applicant respectfully submits that the Waldin does not teach, 
disclose or fairly suggest at least the foregoing recited features of Claim 1 . 

Applicant's amended independent Claims 22 and 41 recite features similar to those set 
forth above regarding Claim 1 that are neither disclosed nor suggested by Waldin. Thus, for 
reasons similar to those set forth regarding Claim 1, Applicant's Claims 22 and 41 are also 
neither disclosed nor suggested by Waldin. 
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Claims that depend from each of the independent Claims 1, 21, and 41 are not disclosed 
or suggested by Waldin for at least those reasons set forth above in connection with the 
independent claims. However, features set forth in the dependent claims are also neither 
disclosed nor suggested by Waldin. 

Claim 63 recites in part, . . . determining, for each sector of said storage device for a 
current virus scan, whether said each sector has been modified since a previous scan; and 
for said current virus scan, scanning only those sectors determined to have been modified 
since said previous scan. As described above, Waldin discloses performing rescanning only of 
those sectors included in the critical sectors file. On the recipient computer, Waldin discloses 
rescanning all sectors in the critical sectors file if there is a change to only a single sector thereof 
Thus, Applicant respectfully submits that Waldin cannot possibly disclose or fairly suggest the 
features of Applicant's Claim 63 which explicitly recites scanning only those sectors 
determined to have been modified since said previous scan. Furthermore, because Waldin (on 
both the originating and recipient computers) only examines those sectors identified in the 
critical sectors file . Applicant respectfully submits that Waldin also cannot possibly disclose or 
fairly suggest determining for each sector of the storage device for a current scan whether each 
sector has been modified since a previous scan. 

For at least the foregoing reasons, Applicant respectfully submits that Waldin does not 
disclose or fairly suggest the features set forth in dependent Claim 63. Dependent Claims 64 and 
65 recite features similar to those of Claim 63 and are also neither disclosed nor suggested by 
Waldin for similar reasons. 
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On page 5 of the Office Action in connection with the rejection of Claims 2 and 42, the 
Office Action appears to equate tracks and sectors to refer to the same entity. Applicant 
respectfully submits that tracks and sectors with respect to a storage device do not refer to the 
same entity which is why, for example, Applicant has both dependent Claims 2 and 3. For a 
rejection to be proper under 35 U.S.C. 102, the cited reference must disclose each feature as 
claimed. Applicant respectfully submits that no where in Waldin does there appear to be any 
mention of a "track". As such, Applicant respectfully submits that the rejection of Claims 2 and 
42 is improper. 

In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 

The rejection of Claims 5-7, 26-68 and 45 under 35 U.S.C. § 103(a) as being 
unpatentable over Waldin is hereby traversed and reconsideration thereof is respectfully 
requested. Applicant respectfully submits that Claims 5-7, 26-28 and 45 are patentable over the 
cited reference. 

Claims 5-7 depend from Claim 1. Claims 26-28 depend from Claim 22. Claim 45 
depends from Claim 41. For reasons set forth above, Waldin does not disclose or suggest 
independent Claims 1, 22 and 45 and also does not disclose or suggested Claims 5-7, 26-28 and 
45 that depend, respectively, therefrom. 
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In view of the foregoing, Applicant respectfully requests that the rejection be 
reconsidered and withdrawn. 



Based on the above, Applicant respectfully requests that the Examiner reconsider and 
withdraw all outstanding rejections and objections. Favorable consideration and allowance are 
earnestly solicited. Should there be any questions after reviewing this paper, the Examiner is 
invited to contact the undersigned at 508-898-8604. 



MUIRHEAD AND SATURNELLI, LLC 
200 Friberg Parkway, Suite 1001 
Westborough, MA 01581 
Tel: (508) 898-8604 
Fax: (508)898-8602 

Date May 3. 2007 




Respectfully submitted, 
MUIRHE AD^NDv SATURNELLI, LLC 



Anne E. Saturnelli 
Registration No. 41,290 
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